udp: Connection tracking for ephemeral, local ports, and related fixes

As we support UDP forwarding for packets that are sent to local
ports, we actually need some kind of connection tracking for UDP.
While at it, this commit introduces a number of vaguely related fixes
for issues observed while trying this out. In detail:

- implement an explicit, albeit minimalistic, connection tracking
  for UDP, to allow usage of ephemeral ports by the guest and by
  the host at the same time, by binding them dynamically as needed,
  and to allow mapping address changes for packets with a loopback
  address as destination

- set the guest MAC address whenever we receive a packet from tap
  instead of waiting for an ARP request, and set it to broadcast on
  start, otherwise DHCPv6 might not work if all DHCPv6 requests time
  out before the guest starts talking IPv4

- split context IPv6 address into address we assign, global or site
  address seen on tap, and link-local address seen on tap, and make
  sure we use the addresses we've seen as destination (link-local
  choice depends on source address). Similarly, for IPv4, split into
  address we assign and address we observe, and use the address we
  observe as destination

- introduce a clock_gettime() syscall right after epoll_wait() wakes
  up, so that we can remove all the other ones and pass the current
  timestamp to tap and socket handlers -- this is additionally needed
  by UDP to time out bindings to ephemeral ports and mappings between
  loopback address and a local address

- rename sock_l4_add() to sock_l4(), no semantic changes intended

- include <arpa/inet.h> in passt.c before kernel headers so that we
  can use <netinet/in.h> macros to check IPv6 address types, and
  remove a duplicate <linux/ip.h> inclusion

Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

1 files changed, 13 insertions, 4 deletions

diff --git a/README.md b/README.md
index 21f1731..08e142a 100644
--- a/README.md
+++ b/README.md
@@ -188,7 +188,8 @@ can't practically run on the host:
 
 For IPv4, the guest is assigned, via DHCP, the same address as the upstream
 interface of the host, and the same default gateway as the default gateway of
-the host. Addresses are never translated.
+the host. Addresses are translated in case the guest is seen using a different
+address from the assigned one.
 
 For IPv6, the guest is assigned, via SLAAC, the same prefix as the upstream
 interface of the host, the same default route as the default route of the
@@ -197,6 +198,12 @@ the upstream address of the host. This means that, with a DHCPv6 client on the
 guest, addresses don't need to be translated. Should the client use a different
 address, the destination address is translated for packets going to the guest.
 
+For UDP and TCP, for both IPv4 and IPv6, packets addressed to a loopback address
+are forwarded to the guest with their source address changed to the address of
+the gateway or first hop of the default route. This mapping is reversed as the
+guest replies to those packets (on the same TCP connection, or using destination
+port and address that were used as source for UDP).
+
 ## Protocols
 
 _passt_ supports TCP, UDP and ICMP/ICMPv6 echo (requests and replies). More
@@ -209,9 +216,11 @@ An IGMP proxy is currently work in progress.
 ## Ports
 
 To avoid the need for explicit port mapping configuration, _passt_ binds to all
-unbound non-ephemeral (0-49152) TCP ports and all unbound (0-65536) UDP ports.
-Binding to low ports (0-1023) will fail without additional capabilities, and
-ports already bound (service proxies, etc.) will also not be used.
+unbound non-ephemeral (0-49152) TCP and UDP ports. Binding to low ports (0-1023)
+will fail without additional capabilities, and ports already bound (service
+proxies, etc.) will also not be used.
+
+UDP ephemeral ports are bound dynamically, as the guest uses them.
 
 Service proxies and other services running in the container need to be started
 before _passt_ starts.